I'm currently building an API for a very busy internet website. Its being written in PHP with MySQL. Now this is my first API that i'm writing that allows people to access their account remotely. Once the API is online, developers will be able to write their own tools from it.
Now I have the API working, but I'm not sure if its entirely safe.
An example URL that would work is:
How about signing requests using HMAC_SHA1 and the user's password? For example, your URL:
Add the timestamp and/or a random string (nonce) and build a normalized base_string:
$base_string = "api_option=list&api_user_name=USERNAME×tamp=1296875073&nonce=hgg65JHFj"; $signature = hmac_sha1($base_string, PASSWORD);
What your server does is to get all the options, excluding the signature, then generate the signature using the same method and compare it to the signature sent by the client, which should be the same.